In order to protect private networks from unwanted network access, a firewall may be implemented in a gateway in order to selectively filter communication from and to the private network. By applying firewall rules, the firewall then lets network packets pass, or blocks them in one or both directions. The rules are typically defined by the source and/or destination addresses of the network packets, or the source and/or destination ports of the network packets.
A firewall may further perform stateful packet inspection thereby keeping track of the state of networking connections such as, for example, TCP or UDP networking connections. This way, a finer-grained control is possible as the rules become dependent on the network connection and thus dynamic. The firewall keeps track of all open network connections by maintaining a table, the state table or state list, with all the pending connections.
In order to have better control on the network traffic passing by a gateway, the firewall may further perform deep packet inspection by controlling the payload data of the networking packets. This way, different types of control can be implemented such as, for example, user access or authorization, protocol compliance, spam filtering and virus detection.
In order to protect a private network further, the gateway's firewall may be combined with network tunnelling. Access to the private network may then be established by a VPN (Virtual Private Network) where a secured networking tunnel is set up between a client device and the gateway. The setup of such a tunnel is only granted upon successful authentication with the gateway, which then functions as a VPN server. By the combination of a firewall and VPN server in the gateway, access to devices in the private network can be authorized on a client or a user level by the VPN server and on a network level by the firewall.